diff options
author | Florian Klink <flokli@flokli.de> | 2020-07-23 17:52:30 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2020-07-23 17:52:30 +0200 |
commit | 8f7a623af689e12e256019a1ed3e3d581fc7d58a (patch) | |
tree | 12145dc1ec51e8036b4e56a34dbdae7cf1f07e81 /nixos/modules | |
parent | 2d6ab6e2f16b578e9b6f87fa5d8fc78b6151d189 (diff) | |
parent | e4029c34fcf274d22fc42e6933c0cc0029888bee (diff) |
Merge pull request #92936 from philandstuff/add-yubikey-agent
yubikey-agent: init at 0.1.3
Diffstat (limited to 'nixos/modules')
-rw-r--r-- | nixos/modules/module-list.nix | 1 | ||||
-rw-r--r-- | nixos/modules/programs/gnupg.nix | 3 | ||||
-rw-r--r-- | nixos/modules/services/security/yubikey-agent.nix | 61 |
3 files changed, 63 insertions, 2 deletions
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 2681a9d3a9e89..a9d20adc63fd1 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -814,6 +814,7 @@ ./services/security/torsocks.nix ./services/security/usbguard.nix ./services/security/vault.nix + ./services/security/yubikey-agent.nix ./services/system/cloud-init.nix ./services/system/dbus.nix ./services/system/earlyoom.nix diff --git a/nixos/modules/programs/gnupg.nix b/nixos/modules/programs/gnupg.nix index 7a3cb588ee719..ce8799b21d692 100644 --- a/nixos/modules/programs/gnupg.nix +++ b/nixos/modules/programs/gnupg.nix @@ -70,6 +70,7 @@ in agent.pinentryFlavor = mkOption { type = types.nullOr (types.enum pkgs.pinentry.flavors); example = "gnome3"; + default = defaultPinentryFlavor; description = '' Which pinentry interface to use. If not null, the path to the pinentry binary will be passed to gpg-agent via commandline and @@ -91,8 +92,6 @@ in }; config = mkIf cfg.agent.enable { - programs.gnupg.agent.pinentryFlavor = mkDefault defaultPinentryFlavor; - # This overrides the systemd user unit shipped with the gnupg package systemd.user.services.gpg-agent = mkIf (cfg.agent.pinentryFlavor != null) { serviceConfig.ExecStart = [ "" '' diff --git a/nixos/modules/services/security/yubikey-agent.nix b/nixos/modules/services/security/yubikey-agent.nix new file mode 100644 index 0000000000000..ac5d7054b2bb3 --- /dev/null +++ b/nixos/modules/services/security/yubikey-agent.nix @@ -0,0 +1,61 @@ +# Global configuration for yubikey-agent. + +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.yubikey-agent; + + # reuse the pinentryFlavor option from the gnupg module + pinentryFlavor = config.programs.gnupg.agent.pinentryFlavor; +in +{ + ###### interface + + meta.maintainers = with maintainers; [ philandstuff rawkode ]; + + options = { + + services.yubikey-agent = { + enable = mkOption { + type = types.bool; + default = false; + description = '' + Whether to start yubikey-agent when you log in. Also sets + SSH_AUTH_SOCK to point at yubikey-agent. + + Note that yubikey-agent will use whatever pinentry is + specified in programs.gnupg.agent.pinentryFlavor. + ''; + }; + + package = mkOption { + type = types.package; + default = pkgs.yubikey-agent; + defaultText = "pkgs.yubikey-agent"; + description = '' + The package used for the yubikey-agent daemon. + ''; + }; + }; + }; + + config = { + environment.systemPackages = [ cfg.package ]; + systemd.packages = [ cfg.package ]; + + # This overrides the systemd user unit shipped with the + # yubikey-agent package + systemd.user.services.yubikey-agent = mkIf (pinentryFlavor != null) { + path = [ pkgs.pinentry.${pinentryFlavor} ]; + }; + + environment.extraInit = optionalString cfg.enable + '' + if [ -z "$SSH_AUTH_SOCK" -a -n "$XDG_RUNTIME_DIR" ]; then + export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/yubikey-agent/yubikey-agent.sock" + fi + ''; + }; +} |